Is there a public PoC exploit available for CVE-2026-14642?

Yes, a public proof-of-concept exploit is available for CVE-2026-14642. Prioritise patching immediately. EPSS: 0.4%.

Class Exam Timetabling CVE-2026-14642

Q: What is the CVSS score of CVE-2026-14642?

CVE-2026-14642 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-41690 MEDIUM

SQL Injection (CWE-89)

2026-07-04 VulDB

PHP SQLi Class And Exam Timetabling System Sourcecodester

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-accessible, no authentication, no user interaction; scope unchanged; partial C/I/A consistent with application-level SQL injection without OS privilege escalation.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 04, 2026 - 19:30 vuln.today

CVSS changed

Jul 04, 2026 - 19:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

DescriptionCVE.org

A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this issue is some unknown functionality of the file /edit_class2.php. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.

AnalysisAI

SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the database to remote unauthenticated attackers via the unvalidated ID parameter in /edit_class2.php. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms trivial, unauthenticated remote exploitation requiring no special conditions. Publicly available exploit code (E:P) lowers the bar to exploitation further, though the product's niche deployment footprint significantly limits real-world blast radius. No KEV listing; no patch identified at time of analysis.

Technical ContextAI

The affected product is a PHP-based academic scheduling web application distributed by SourceCodester (cpe:2.3:a:sourcecodester:class_and_exam_timetabling_system:*:*:*:*:*:*:*:*). The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): user-supplied input from the ID parameter in the /edit_class2.php endpoint is concatenated directly into a SQL query without parameterization or escaping. This is a classic first-generation SQL injection pattern common in legacy PHP applications that rely on direct database query construction rather than prepared statements or ORM abstractions. The affected version is 1.0, and the wildcard CPE suggests no patched version has been formally identified.

RemediationAI

No vendor-released patch has been identified at time of analysis - the wildcard CPE and absence of a fix-version reference confirm this. As an immediate compensating control, restrict access to /edit_class2.php at the web server or WAF layer to trusted IP ranges only, eliminating unauthenticated network exposure. If the application must remain publicly accessible, deploy a WAF rule blocking SQL metacharacters (quotes, comment sequences, UNION/SELECT keywords) in the ID parameter - note this is a detection aid, not a secure fix, and may be bypassed by obfuscation. The definitive remediation is to rewrite the ID parameter handling using PHP PDO or MySQLi prepared statements with bound parameters, replacing any direct string concatenation into the SQL query. Source available at sourcecodester.com; consider forking and applying the fix directly if the vendor does not release an update. Reference VulDB entry https://vuldb.com/vuln/376158 and the PoC at https://github.com/sunjingyuan123/ccvvee/issues/1 for technical detail to guide the patch.